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(U//FOUO) CLASSIFICATION GUIDE TITLE/NUMBER: CRYPTANALYSIS Guide 02-12 

(U) PUBLICATION DATE: 13 September 2005 

(U) OFFICE OF ORIGIN: Cryptanalysis & Exploitation Services (S31) 

(U//FOUO) 

(U//FOUO) PHONE: 



(U//FOUO) ORIGINAL CLASSIFICATION AUTHORITY: 



Description of Information 


Classification/ 

Markings 


Reason 


Declass 


Remarks 


1 . (U) The fact that NSA/CSS exploits 

cryptographic information security devices 
and systems. 


UNCLASSIFIED 


N/A 


N/A 




2. (C) The fact that NSA/CSS works with 

Second Party partners on exploiting 
cryptographic information security devices 
and systems. 


CONFIDENTIAL 


1 .4 (c) 


20291 123 




3. (S) The fact that NSA/CSS works with 

unspecified Third Party partners on 
exploiting cryptographic information 
security devices and systems. 


SECRET 


1.4(c) 


20291123 




4. (U) The fact that NSA/CSS exploits 

unintended cryptographic vulnerabilities in 
commercial or indigenous information 
security devices and systems, as long as 
neither the vulnerability nor the targeted 
device/ system is identified. 


UNCLASSIFIED 


N/A 


N/A 




5 . (TS//SI) The fact that NSA/CSS makes 
cryptographic modifications to commercial 
or indigenous cryptographic information 
security devices or systems in order to 
make them exploitable. 


TOP SECRET// 
COMINT 
at a minimum 


1 .4 (c) 


20291123 


(U) Specifying the specific system 
is protected by an ECI.. 


6. (U) The fact that NSA/CSS has 

cryptanalytic techniques to exploit 
cryptographic components of commercial 
or indigenous information security devices 
or systems. 


UNCLASSIFIED 


N/A 


N/A 


(U) Additional details will raise 
the classification and may be 
protected by an ECI. 


7. (C) The fact that NSA/CSS has the ability 

to recover cryptovariables used to exploit 
commercial or indigenous cryptographic 
information security devices or systems. 


CONFIDENTIAL 


1 -4 (c) 


20291123 


(C) Details of CV recovery are 
protected by an ECI. 

(C) Specifying a specific system 
for which we can recovery CVs is 
protected by an ECI. 
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Description of Information 


Classification/ 

Markings 


Reason 


Declass 


Remarks 


8. (U) The fact that NS A/CSS successfully 

exploits cryptographic components of 
commercial or indigenous cryptographic 
information security devices or systems 
without specifying the device or system. 


UNCLASSIFIED 


N/A 


N/A 


(U) Additional details will require 
the classification and may be 
protected by an ECI. 


9 . (U//FOUO) The fact that NS A/CSS 
successfully exploits cryptographic 
components of commercial or indigenous 
cryptographic information security devices 
or systems when the device or system is 
specified. 


TOP SECRET// 
COMINT 
at a minimum 


1 .4 (c) 


20291123 


(U) Additional details may be 
protected by an ECI. 


10. (TS) The fact that NS A/CSS obtains 
cryptographic details of commercial 
cryptographic information security systems 
through industry relationships. 


TOP SECRET 
at a minimum 


1 .4 (c) 


20291123 


(C) Identification of the system or 
company is protected as COMINT 
and ECI. 



(U) DEFINITIONS : 

(U//FOUO) Information security device or system: A device or system that provides any of the following services for 
communications or information systems: confidentiality, data integrity, authentication and authorization. 

(U//FOUO) Cryptanalytic vulnerability: A flaw in the design, implementation or system integration of cryptography used in an 
information security device, or a flaw in the way that a cryptographic information security device is used. 

(U//FOUO) Unintended cryptographic vulnerability: Security is less than advertised by the manufacturer. 

(U//FOUO) Indigenous: Non-commercial cryptographic information security system or device developed by a SIGINT target. 
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